NLnetLabs-krill/defaults/krill.conf

# Specify how to set up the HTTPS certificate for Krill
#   existing: Expects an existing certificate and key in $data_dir/ssl
#   generate: Will generate a new key-pair and self-signed cert if
#             they cannot be found in $data_dir/ssl
#
# Note: we strongly recommend that you use a proxy like nginx, apache, or
# <your-choice-here> for HTTPS on a public network.
#
### https_mode = "generate"

# Specify the ip address and port number that the server will use.
#
# Note: we recommend that you use the defaults and use a proxy if you
# must make your Krill instance accessible remotely.
#
### ip             = "localhost"
### port           = 3000

# Specify the directory where the publication server will store its data.
# Note that clustering through a shared data directory is not supported.
# But, we plan to look into a proper clustering solution later.
#
### data_dir = "./data"

# Specify the path to the PID file for Krill.
#
# Defaults to "krill.pid" under the 'data_dir' specified above.
#
### pid_file = "./data/krill.pid"

# Specify the base public service URI hostname and port.
#
# The default service URI is set to https://localhost:3000/ regardless of the
# IP and port configured above (but matching their default). This is fine for
# simple setups where you use Krill to run your own CA only and you use the
# CLI from localhost.
#
# However, if you need to access Krill remotely, or if you are serving as a
# parent CA, or Publication Server, to others, then make sure that you use a
# public URI here *and* make sure that you use a proxy server with a proper
# HTTPS certificate in front of Krill.
#
# At present this MUST be an https URI with a hostname and optional port number only.
# It is not allowed to use a Krill specific path prefix. If you have a strong
# motivation for this, then please commont on the following github issue:
# https://github.com/NLnetLabs/krill/issues/263
#
# Krill UI, API and service URIs will be derived as follows:
#  <service_uri>api/v1/...                (api)
#  <service_uri>rfc8181                   (for remote publishers)
#  <service_uri>rfc6492                   (for remote children)
#  <service_uri>rrdp/..                   (override with rddp_service_uri, see below)
#  <service_uri>...                       (various UI resources)
### service_uri = "https://localhost:3000/"

# Specify whether an embedded repository should be started. For many users
# it will be better to use a repository server provided by a third party, e.g.
# the RIR or NIR under which resources are received.
#
# Note that an existing embedded repository server will be removed if this
# setting is set to 'false' (default) AND there are no current publishers (i.e.
# all CAs use an external repository).
#
# For more information on running Krill as Publication Server see:
# https://rpki.readthedocs.io/en/latest/krill/publication-server.html
#
### repo_enabled = false

# Specify the base rsync repository for this server. Publishers will get
# a base URI that is based on the 'publisher_handle' in the XML file.
#
# Note, you need to set this parameter if (and only if) you chose to enable
# the repository function above (repo_enabled). If you did, you should set up
# an rsync daemon to expose $data_dir/rsync to serve this data. The uri defined
# here should match the module name in your rsync configuration.
#
# Furthemore.. note that the default 'localhost' is only allowed to be used
# when the KRILL_TEST ENV variable has been set.
#
### rsync_base = "rsync://localhost/repo/"

# Note, you may need to set this parameter if you chose to enable the repository
# function above (repo_enabled). By default Krill will use a public RRDP URI
# which is based on the service_uri. Use this directive use a different public
# URI to access the RRDP files.
#
### rrdp_service_uri = "$service_uri/rrdp/"

# Log level
#
# The maximum log level ("off", "error", "warn", "info", or "debug") for
# which to log messages.
#
# Defaults to "warn"
#
### log_level = "warn"

# Log type
#
# Where to log to. One of "stderr" for stderr, "syslog" for syslog, or "file"
# for a file. If "file" is given, the "log_file" field needs to be given, too.
#
### log_type = "file"

# Syslog facility
#
# The syslog facility to log to if syslog logging is used. Defaults to "daemon".
#
### syslog_facility = "daemon"

# Log file
#
# The path to the file to log to if file logging is used. If the path is
# relative, it is relative to the current working directory from which
# the binary is executed.
#
### log_file = "./krill.log"

# Master Authorization Bearer Token
#
# Define a master token that can be used to interact with the API. Token use
# is modelled after OAuth 2.0 Bearer Tokens (RFC 6750), which are expected be
# included as an HTTP header in requests by clients.
#
# If you do not specify a value here, the server will insist that you provide
# a token as an environment variable with the key "KRILL_AUTH_TOKEN".
#
### auth_token =

# CA certificate refresh rate
#
# This defines the rate, in seconds, for Krill CAs to to contact their parent
# CA and query for updates in resource entitlements.
#
# Defaults to 10 minutes
#
### ca_refresh = 600

# Restrict size of messages sent to the API
#
# Default 256 kB
#
### post_limit_api = 262144

# Restrict size of messages sent to the RFC 8181 publication protocol
#
# Default 32MB (enough for a keyroll with about 8000 issued certificates)
#
### post_limit_rfc8181 = 33554432

# Specify a log directory for logging RFC 8181 (publication protocol)
# exchanges. If this directive is set Krill will log all meaningful
# RFC 8181 exchanges in this directory, meaning exchanges that resulted
# in a change or an error.
#
# If this directive is not specified, Krill will NOT log these exchanges.
# Do not set an empty value for the directive in this case, just leave
# it out.
#
# Defaults to NO logging!
#
### rfc8181_log_dir = </some/path>

# Restrict size of messages sent to the RFC 6492 up-down protocol
#
# Default 1MB (enough for a keyroll with certs of ~400kb, the biggest known cert is 220kB)
#
### post_limit_rfc6492 = 1048576

# Specify a log directory for logging RFC 6492 (up-down protocol)
# exchanges. If this directive is set Krill will log all meaningful
# RFC 6492 exchanges in this directory, meaning exchanges that resulted
# in a change or an error.
#
# If this directive is not specified, Krill will NOT log these exchanges.
# Do not set an empty value for the directive in this case, just leave
# it out.
#
# Defaults to NO logging!
#
### rfc6492_log_dir = </some/path>

# Enable loading BGP Dumps from RIS for ROA vs BGP analysis.
#
# bgp_risdump_enable = true
# bgp_risdump_v4_uri = http://www.ris.ripe.net/dumps/riswhoisdump.IPv4.gz
# bgp_risdump_v6_uri = http://www.ris.ripe.net/dumps/riswhoisdump.IPv6.gz


######################################################################################
#                                                                                    #
#                --------======== DANGER ZONE ========--------                       #
#                                                                                    #
#  Do not change the options below, unless you are really certain that you need to   #
#  override Krill's default behaviour.                                               #
#                                                                                    #
######################################################################################


#
#                               ROA Aggregation
#
# It is recommended that separate ROAs are used for each authorized prefix, even
# though the RFC allows for multiple prefixes for the same ASN to be combined on
# a single ROA object. The reason for this is that the ROA will become invalid
# if any of the listed prefixes no longer appears on your CA's certificate. Note
# that Krill will automatically clean up over-claiming ROAs when it finds that its
# resources have been shrunk, but there is a possible time window where ROAs can
# be invalid before Krill discovers the shrinkage.
#
# That said, if there would be too many ROAs then this will impact all RPKI
# validators, therefore Krill will by default start aggregating ROAs per ASN
# when more than 100 ROAs would be issued. Conversely, Krill will start de-
# aggregating again when the number of authorizations drops below 90.
#
# This behaviour can be overridden with the following directives:
# roa_aggregate_threshold = 100
# roa_deaggregate_threshold = 90


#
#                               Republication Intervals
#
# The RPKI uses Manifests (RFC 6486) to communicate the list of current RPKI
# objects (such as ROAs) to RPKI Validators. Manifests are used to protect against
# attacks, or incidents, where Validators only see a partial view of the RPKI
# repository. For this to work properly Validators will need to know how 'fresh'
# the Manifests are - otherwise they would be vulnerable to replay attacks where
# they are presented old versions of Manifests thus withholding them from discovering
# new RPKI objects.
#
# Manifests have two important dates included in them:
# 1- the 'next update time'
# 2- an expiration time
#
# When the next update time is passed manifests will become 'stale'. This means
# the Validators may either warn about the objects listed in these manifests, or
# they may even reject these objects altogether. There is current discussion about
# aligning this behaviour in the IETF - but for the moment the outcome will vary
# between Validator implementations.
#
# When the expiration time (not after time on the embedded EE certificate of the
# Manifest) passes, then the Manifest will be considered invalid by all Validator
# implementations.
#
# So, if Validators are subject to replay attacks of Manifests they will be
# unaware until these times have passed. After these times the Manifest and all
# listed RPKI objects will become invalid. When ROA objects become invalid, this
# typically means that the Route Announcement will be considered "Not Found", rather
# than invalid. So, typically they would not be dropped, but they are no longer
# protected by RPKI.
#
# One could therefore argue that short times should be used. However, if the times
# chosen are too short, then this will leave your CA vulnerable to possible
# operational issues with its RPKI repository - or outages of your CA itself.
#
# So, in short, the chosen values are a balance between the wish to limit the
# vulnerability to replay attacks vs the time an operator has to solve operational
# issues.
#
# Krill uses the following defaults:
#
# The "next update" time is 24 hours:
# timing_publish_next_hours = 24
#
# The "not after time" on the EE certificate is 7 days from issuance:
# timing_publish_valid_days = 7
#
# Krill will automatically re-publish new Manifests if they would become stale
# in 8 hours. Because re-publication happens hourly, this leaves the operator
# with a minimum of 7 hours to fix issues if re-publication should fail.
# timing_publish_hours_before_next = 8


#
#                 ROA and Delegate Certificate Times
#
# Krill will issue ROAs, and child CA certificates if you have delegated resources
# to child CAs, with a "not after" time of 52 weeks from issuance, and it will
# re-issue those ROAs and certificates 4 weeks before they would expire.
#
# Because of the automatic renewal there should be no real need to use longer
# validity times. In fact using longer times could have a negative impact on
# Validator performance because the Certificate Revocation Lists would become
# bigger.
#
# So, we do NOT recommend overriding the following values, except perhaps for
# testing purposes:
# timing_child_certificate_valid_weeks = 52
# timing_child_certificate_reissue_weeks_before = 4
# timing_roa_valid_weeks = 52
# timing_roa_reissue_weeks_before = 4